Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter updates for your net-next tree, they are: 1) Remove useless debug message when deleting IPVS service, from Yannick Brosseau. 2) Get rid of compilation warning when CONFIG_PROC_FS is unset in several spots of the IPVS code, from Arnd Bergmann. 3) Add prandom_u32 support to nft_meta, from Florian Westphal. 4) Remove unused variable in xt_osf, from Sudip Mukherjee. 5) Don't calculate IP checksum twice from netfilter ipv4 defrag hook since fixing af_packet defragmentation issues, from Joe Stringer. 6) On-demand hook registration for iptables from netns. Instead of registering the hooks for every available netns whenever we need one of the support tables, we register this on the specific netns that needs it, patchset from Florian Westphal. 7) Add missing port range selection to nf_tables masquerading support. BTW, just for the record, there is a typo in the description of 5f6c253ebe93b0 ("netfilter: bridge: register hooks only when bridge interface is added") that refers to the cluster match as deprecated, but it is actually the CLUSTERIP target (which registers hooks inconditionally) the one that is scheduled for removal. ====================
Showing the changes to include/uapi (1 of 32 files). Show all
Unified · Split
| @@ -681,6 +681,7 @@ enum nft_exthdr_attributes { · 680 unmodified lines | |||
| 681 | * @NFT_META_IIFGROUP: packet input interface group | 681 | * @NFT_META_IIFGROUP: packet input interface group |
| 682 | * @NFT_META_OIFGROUP: packet output interface group | 682 | * @NFT_META_OIFGROUP: packet output interface group |
| 683 | * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid) | 683 | * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid) |
| 684 | * @NFT_META_PRANDOM: a 32bit pseudo-random number | ||
| 684 | */ | 685 | */ |
| 685 | enum nft_meta_keys { | 686 | enum nft_meta_keys { |
| 686 | NFT_META_LEN, | 687 | NFT_META_LEN, |
| @@ -707,6 +708,7 @@ enum nft_meta_keys { · 20 unmodified lines | |||
| 707 | NFT_META_IIFGROUP, | 708 | NFT_META_IIFGROUP, |
| 708 | NFT_META_OIFGROUP, | 709 | NFT_META_OIFGROUP, |
| 709 | NFT_META_CGROUP, | 710 | NFT_META_CGROUP, |
| 711 | NFT_META_PRANDOM, | ||
| 710 | }; | 712 | }; |
| 711 | 713 | ||
| 712 | /** | 714 | /** |
| @@ -949,10 +951,14 @@ enum nft_nat_attributes { · 236 unmodified lines | |||
| 949 | * enum nft_masq_attributes - nf_tables masquerade expression attributes | 951 | * enum nft_masq_attributes - nf_tables masquerade expression attributes |
| 950 | * | 952 | * |
| 951 | * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32) | 953 | * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32) |
| 954 | * @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers) | ||
| 955 | * @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers) | ||
| 952 | */ | 956 | */ |
| 953 | enum nft_masq_attributes { | 957 | enum nft_masq_attributes { |
| 954 | NFTA_MASQ_UNSPEC, | 958 | NFTA_MASQ_UNSPEC, |
| 955 | NFTA_MASQ_FLAGS, | 959 | NFTA_MASQ_FLAGS, |
| 960 | NFTA_MASQ_REG_PROTO_MIN, | ||
| 961 | NFTA_MASQ_REG_PROTO_MAX, | ||
| 956 | __NFTA_MASQ_MAX | 962 | __NFTA_MASQ_MAX |
| 957 | }; | 963 | }; |
| 958 | #define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1) | 964 | #define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1) |